Merak Mail Server 7.4.5 calendar.html schedule Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/10966/info The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities. The vulnerabilities reported are: - Multiple cross-site scripting vulnerabilities - An HTML injection vulnerabili...

PHP 4.x/5.0.1 PHP_Variables Remote Memory Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/11334/info A vulnerability is reported to present itself in the array parsing functions of the 'phpvariables.c' PHP source file. The vulnerability occurs when a PHP script is being used to print URI parameters or data, th...

Merak Mail Server 7.4.5 address.html Path Disclosure

No description provided by source. source: http://www.securityfocus.com/bid/10966/info The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities. The vulnerabilities reported are: - Multiple cross-site scripting vulnerabilities - An HTML injection vulnerabili...

Merak Mail Server 7.4.5 address.html Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/10966/info The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities. The vulnerabilities reported are: - Multiple cross-site scripting vulnerabilities - An HTML injection vulnerabili...

Merak Mail Server 7.4.5 attachment.html attachmentpage_text_error Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/10966/info The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities. The vulnerabilities reported are: - Multiple cross-site scripting vulnerabilities - An HTML injection vulnerabili...

Merak Mail Server 7.4.5 settings.html Multiple Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/10966/info The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities. The vulnerabilities reported are: - Multiple cross-site scripting vulnerabilities - An HTML injection vulnerabili...

suPHP -- Privilege escalation

suPHP developer Sebastian Marsching reports: When the suPHPPHPPath was set, modsuphp would use the specified PHP executable to pretty-print PHP source files MIME type x-httpd-php-source or application/x-httpd-php-source. However, it would not sanitize the environment. Thus a user that was allowed...

CSDJCMS拿shell漏洞与PHP源码分析过程

简要描述： CSDJCMS漏洞后台拿shell 详细说明： includeonce"include/install.php"; ifSIsInstall==0 header"Location:install/install.php"; includeonce"include/label.php"; ifSWebmode==1 or !fileexists"index.html" //缓存区 $cacheid ='index'; if!$cacheopt-start$cacheid echo GetTemp"index.html",0; $cacheopt-end; else...

Generic HTTP Directory Traversal Utility

This module allows you to test if a web server or web application is vulnerable to directory traversal with three different actions. The 'CHECK' action default is used to automatically or manually find if directory traversal exists in the web server, and then return the path that triggers the...

PHP CGI Query String Parameters Command Execution

Added: 05/15/2012 CVE: CVE-2012-1823 BID: 53388 OSVDB: 81633 Background PHP is a widely used general-purpose scripting language that is especially suited for Web development. Problem When configured as a CGI script aka php-cgi, PHP does not properly handle query string parameters which are passed...

[eVuln.com] Cookie authentication bypass in Alguest

New eVuln Advisory: Cookie authentication bypass in Alguest Summary: http://evuln.com/vulns/152/summary.html Details: http://evuln.com/vulns/152/description.html -----------Summary----------- eVuln ID: EV0152 Software: Alguest Vendor: n/a Version: 1.1c-patched Critical Level: high Type:...

CVE-2009-2130

Elvin 1.2.0 allows remote attackers to read the PHP source code of 1 login.ei, 2 jumpbug.ei, or 3 createaccount.ei in inc/ via a direct request...

Code injection

front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a filename in the sFileName parameter...

CVE-2008-5936

CVE-2008-5936 affects front-end/edit.php in mini-pub 0.3 and earlier. The vulnerability allows remote attackers to read files and obtain PHP source code by manipulating the sFileName parameter, exposing partial confidentiality impact. The CVSS score is provided as 5.0 (MEDIUM) with network vector...

Access online decryption[PHP source code]-vulnerability warning-the black bar safety net

You can only decrypt 2 0 0 0 or 9 7 MDB file ? /site:/ /If reproduced please retain this information / /by:7jdg QQ:7 2 5 9 5 6 1 / $file=$FILES'uploadfile''tmpname'; $oldname =$FILES'uploadfile''name'; $ext =via strtolowersubstrstrrchr$oldname, '.', 1; if $file if $ext != "the mdb" echo "your pas...

GLSA-200804-19 : PHP Toolkit: Data disclosure and Denial of Service

The remote host is affected by the vulnerability described in GLSA-200804-19 PHP Toolkit: Data disclosure and Denial of Service Toni Arnold, David Sveningsson, Michal Bartoszkiewicz, and Joseph reported that php-select does not quote parameters passed to the 'tr' command, which could convert the...

PHP Toolkit: Data disclosure and Denial of service

Background PHP Toolkit is a utility to manage parallel installations of PHP within Gentoo. It is executed by the PHP ebuilds at setup. Description Toni Arnold, David Sveningsson, Michal Bartoszkiewicz, and Joseph reported that php-select does not quote parameters passed to the "tr" command, which...

CVE-2007-5654

LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."...

Design/Logic Flaw

LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed by a new extension, as demonstrated by reading PHP source code via requests for .php%00.txt files, aka "Mime Type Injection."...

osCommerce 2.2 - extras Source Code Disclosure

osCommerce 2.2 - extras Source Code Disclosure ---- osCommerce \n"; print nl2brhtmlentitiesimplode$readme, ' '; print "Continue\n"; print "\n"; exit; ... google search: inurl:"extras/update.php" intext:mysql.php -display...